It's either set by the user, or it's already set on the device based on the market the product is selling into. Phones have GPS though, so I'm not sure how that factors into it.
It's usually programmed into an EEPROM inside the device. Nowadays for compliance reasons, the radio firmware may enforce it rather than the software driver.
It'll have a region set by the manufacturer in it's firmware. IEEE 802.11d-2001 also added country information to AP beacons and probes. Nearby access points will advertise a country code to each other. Hostapd and/or the Wi-Fi device firmware can take advantage of that.
APs are normally programmed based on the market they're sold into. Client devices receive information about which regulatory domain they're in from the AP they're connecting to.
There's no technical mechanism to prevent someone operating an AP inappropriately. That's more an opportunity to discover how effective your local enforcement agency is.
The brand I use has a drop down menu to select from.
Also, regarding WiFi equipment. Finding out the quality of consumer WiFi gear is near impossible before buying, because of so many other factors affecting wifi performance (especially that I use mostly 2.4ghz). If anyone has a foolproof method for this please let me know.